[LIBCLOUD-55] this python project is vulnerable to MITM as it fails to verify the ssl validity of the remote destination.

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 0.4.0
• Component/s: Core
• Assignee: Jed Smith
• Reporter: dave b ^^
• Created: 29/Sep/10 09:21
• Updated: 29/Sep/10 20:06
• Resolved: 29/Sep/10 16:08

Description

this python project is vulnerable to MITM as it fails to verify the ssl validity of the remote destination.
urllib / urllib2, httplib.SHTTPConnection do not verify ssl at all by default.
from base.py
class ConnectionKey(object):
""" A Base Connection class to derive from.
""" conn_classes = (httplib.HTTPConnection, httplib.HTTPSConnection)

.... def connect(self, host=None, port=None):
..... connection = self.conn_classesself.secure

this request can be MITMed leading to the compromise of a users API key - where a secured https connection was requested, but can be MITM'ed.